Set @timestamp manually

Elastic Stack Logstash
1

Hi,

Currently we use the logstash date filter to match our timestamp field (named _time) using this config:

date {
        match => ["_time", "UNIX_MS"]
        remove_field => ["_time"]
    }

I see that all this plugin is doing is put the value as a unix timestamp in the @timestamp field.
But the _time field is already a unix timestamp (Created using javascript Date.now()), so basically if i will just rename my _time field @timestamp will it work the same?

2

Try it. :slight_smile:

My guess is no. the @timestamp field is technically a LogStash::Timestamp type. It's also one of those special exported fields that exists at the event genesis, so you can't simply rename _time to @timestamp (it may not let you overwrite the existing @timestamp field).

But like I say, try it :grinning:. I'm interested to see the outcome to.